@inneranimalmedia/agentsam-sdk 2.6.4 → 2.6.7

package/src/commands/update.js

@@ -0,0 +1,140 @@
+/**
+ * gcloud-like update preview. Does not silently upgrade.
+ */
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import pkg from '../../package.json' with { type: 'json' };
+
+const execFileAsync = promisify(execFile);
+
+function writeLine(write, value = '') {
+  write(`${value}\n`);
+}
+
+async function latestNpmVersion(name, env) {
+  try {
+    const { stdout } = await execFileAsync('npm', ['view', name, 'version'], {
+      timeout: 20000,
+      env,
+      maxBuffer: 64 * 1024,
+    });
+    return String(stdout || '').trim() || null;
+  } catch {
+    return null;
+  }
+}
+
+export async function runUpdate(argv = [], options = {}) {
+  const write = options.write || ((s) => process.stdout.write(s));
+  const env = options.env || process.env;
+  const json = argv.includes('--json');
+  const apply = argv.includes('--apply') || argv.includes('-y');
+
+  const current = pkg.version;
+  const available = await latestNpmVersion('@inneranimalmedia/agentsam-sdk', env);
+
+  const payload = {
+    schema_version: 'agentsam-update-v1',
+    current: {
+      sdk: current,
+      package: '@inneranimalmedia/agentsam-sdk',
+    },
+    available: {
+      sdk: available,
+    },
+    changes: available && available !== current
+      ? [
+          { component: 'AgentSam CLI / SDK', from: current, to: available },
+        ]
+      : [],
+    breaking_changes: [],
+    migration: [],
+    native_notes: [
+      'If npm warns about allow-scripts for node-pty/protobufjs:',
+      '  npm config set allow-scripts=node-pty,protobufjs --location=user',
+      '  npm rebuild node-pty protobufjs',
+    ],
+    installer_note:
+      '/install/studio currently installs the SDK CLI globally; signed Local Studio .app install is a separate graduation ticket.',
+  };
+
+  if (json) {
+    write(JSON.stringify(payload, null, 2) + '\n');
+    return 0;
+  }
+
+  writeLine(write, '');
+  writeLine(write, '  Agent Sam update');
+  writeLine(write, '');
+  writeLine(write, '  Current');
+  writeLine(write, `    SDK             ${current}`);
+  writeLine(write, '');
+  writeLine(write, '  Available');
+  writeLine(write, `    SDK             ${available || '(could not query npm registry)'}`);
+  writeLine(write, '');
+
+  if (!available) {
+    writeLine(write, '  ✕ Could not determine latest version. Check network / npm auth.');
+    writeLine(write, '');
+    return 1;
+  }
+
+  if (available === current) {
+    writeLine(write, '  ✓ Already on the latest published SDK.');
+    writeLine(write, '');
+    writeLine(write, '  Notes');
+    for (const note of payload.native_notes) writeLine(write, `    ${note}`);
+    writeLine(write, `    ${payload.installer_note}`);
+    writeLine(write, '');
+    return 0;
+  }
+
+  writeLine(write, '  Changes');
+  for (const row of payload.changes) {
+    writeLine(write, `    ${row.component.padEnd(28)} ${row.from} → ${row.to}`);
+  }
+  writeLine(write, '');
+  writeLine(write, '  Breaking changes');
+  writeLine(write, '    none reported by this preview (read release notes before applying)');
+  writeLine(write, '');
+  writeLine(write, '  Native dependency tip');
+  for (const note of payload.native_notes) writeLine(write, `    ${note}`);
+  writeLine(write, '');
+  writeLine(write, '  Installer note');
+  writeLine(write, `    ${payload.installer_note}`);
+  writeLine(write, '');
+
+  if (!apply) {
+    writeLine(write, '  [enter] not auto-run from non-interactive CLI');
+    writeLine(write, '  Apply with:');
+    writeLine(write, '    npm install -g @inneranimalmedia/agentsam-sdk@latest');
+    writeLine(write, '    agentsam update --apply   # prints the same npm command guidance');
+    writeLine(write, '');
+    return 0;
+  }
+
+  writeLine(write, '  Applying via npm (global)…');
+  try {
+    const { stdout, stderr } = await execFileAsync(
+      'npm',
+      ['install', '-g', `@inneranimalmedia/agentsam-sdk@${available}`],
+      { timeout: 300000, env, maxBuffer: 4 * 1024 * 1024 },
+    );
+    if (stdout) write(stdout.endsWith('\n') ? stdout : `${stdout}\n`);
+    if (stderr) write(stderr.endsWith('\n') ? stderr : `${stderr}\n`);
+    writeLine(write, '');
+    writeLine(write, '  Verifying…');
+    writeLine(write, '    ✓ package install attempted');
+    writeLine(write, '    → run: agentsam --version && agentsam status');
+    writeLine(write, '    → if PTY scripts were blocked:');
+    writeLine(write, '         npm config set allow-scripts=node-pty,protobufjs --location=user');
+    writeLine(write, '         npm rebuild node-pty protobufjs');
+    writeLine(write, '');
+    return 0;
+  } catch (error) {
+    write(String(error?.stderr || error?.message || error));
+    writeLine(write, '');
+    writeLine(write, '  ✕ Update failed. No silent fallback.');
+    return 1;
+  }
+}

package/src/commands/whoami.js

@@ -3,60 +3,131 @@ import { resolveAccountAuthority } from '../lib/auth.js';
 import {
   describeAccountSession,
   resolveAccountApiKey,
+  readAccountSession,
+  saveAccountSession,
 } from '../lib/account-session.js';
 import { listProviderCredentialStatus } from '../lib/provider-credentials.js';
+import { projectWhoamiCapabilities } from '../lib/whoami-capabilities.js';
+import { collectLocalTerminalContext, mergeTerminalContexts } from '../lib/terminal-local.js';
+import {
+  resolveCurrentAppContext,
+  resolvePlatformAccountIssuer,
+} from '../lib/app-authority.js';
 
 function writeLine(write, value = '') { write(`${value}\n`); }
 
+function epochToIso(value) {
+  const n = Number(value);
+  if (!Number.isFinite(n) || n <= 0) return null;
+  const ms = n > 1e12 ? n : n * 1000;
+  try {
+    return new Date(ms).toISOString();
+  } catch {
+    return null;
+  }
+}
+
 function safeTerminalContext(value = {}) {
   return {
     available: value?.available === true,
-    instances: (value?.instances || []).map((row) => ({
-      id: row?.id || null,
-      name: row?.name || null,
-      kind: row?.kind || null,
-      provider: row?.provider || null,
-      status: row?.status || null,
-      platform: row?.platform || null,
-      arch: row?.arch || null,
-      active_connection_count: Number(row?.active_connection_count || 0),
-      default_connection_id: row?.default_connection_id || null,
-      last_seen_at: row?.last_seen_at || null,
-    })),
-    connections: (value?.connections || []).map((row) => ({
-      id: row?.id || null,
-      instance_id: row?.instance_id || null,
-      name: row?.name || null,
-      kind: row?.kind || null,
-      provider: row?.provider || null,
-      transport: row?.transport || null,
-      transport_provider: row?.transport_provider || null,
-      is_active: row?.is_active === true,
-      is_default: row?.is_default === true,
-      health_status: row?.health_status || 'unknown',
-      last_seen_at: row?.last_seen_at || null,
-    })),
+    instances: (value?.instances || []).map((row) => {
+      const lastSeen = row?.last_seen_at ?? null;
+      const id = row?.id || row?.instance_id || null;
+      const compute = row?.compute_provider || row?.provider || null;
+      return {
+        id,
+        instance_id: id,
+        name: row?.name || null,
+        kind: row?.kind || null,
+        provider: compute,
+        compute_provider: compute,
+        status: row?.status || null,
+        hostname: row?.hostname || null,
+        platform: row?.platform || null,
+        arch: row?.arch || null,
+        hw_model: row?.hw_model || null,
+        active_connection_count: Number(row?.active_connection_count || 0),
+        default_connection_id: row?.default_connection_id || null,
+        last_seen_at: lastSeen,
+        last_seen_at_iso: row?.last_seen_at_iso || epochToIso(lastSeen),
+      };
+    }),
+    connections: (value?.connections || []).map((row) => {
+      const lastSeen = row?.last_seen_at ?? null;
+      const id = row?.id || row?.connection_id || null;
+      const compute = row?.compute_provider || row?.provider || null;
+      return {
+        id,
+        connection_id: id,
+        instance_id: row?.instance_id || null,
+        name: row?.name || null,
+        kind: row?.kind || null,
+        provider: compute,
+        compute_provider: compute,
+        transport: row?.transport || null,
+        transport_provider: row?.transport_provider || null,
+        endpoint_url: row?.endpoint_url || null,
+        route_hostname: row?.route_hostname || null,
+        public_url: row?.public_url || row?.endpoint_url || null,
+        is_active: row?.is_active === true,
+        is_default: row?.is_default === true,
+        health_status: row?.health_status || 'unknown',
+        last_seen_at: lastSeen,
+        last_seen_at_iso: row?.last_seen_at_iso || epochToIso(lastSeen),
+      };
+    }),
   };
 }
 
-function capabilityProbe(credentials = []) {
-  const has = (provider) => credentials.some((row) => row.provider === provider && row.configured);
-  return {
-    repository: { available: true },
-    database: { available: true, drivers: ['sqlite'] },
-    vectors: { available: true, drivers: ['local_exact'] },
-    models: {
-      available: has('openai') || has('anthropic') || has('gemini') || has('xai') || has('cursor') || has('cloudflare'),
-      configuredProviders: ['openai', 'anthropic', 'gemini', 'xai', 'cursor', 'cloudflare'].filter((p) => has(p)).length,
-    },
-    deploy: { available: has('cloudflare') },
-  };
+function attachOwnerAccountId(credentials = [], ownerAccountId) {
+  const owner = ownerAccountId == null ? '' : String(ownerAccountId).trim();
+  if (!owner) return credentials;
+  return (credentials || []).map((row) => {
+    const next = {
+      ...row,
+      owner_account_id: owner,
+    };
+    if (row.provider === 'cloudflare' && row.account_id && row.account_id !== owner) {
+      next.cloudflare_account_id = row.account_id;
+    }
+    // Platform + all providers: account_id means AgentSam au_* for this user
+    next.account_id = owner;
+    return next;
+  });
+}
+
+function normalizeAuthKind(kind) {
+  const raw = String(kind || '').trim();
+  if (raw === 'api_key') return 'agentsam_api_key';
+  if (raw === 'browser_oauth' || raw === 'oauth_session') return 'agentsam_browser_oauth';
+  return raw || null;
+}
+
+function authLabelFor(kind, authType) {
+  const k = normalizeAuthKind(kind) || normalizeAuthKind(authType);
+  if (k === 'agentsam_api_key') return 'AgentSam API Key';
+  if (k === 'agentsam_browser_oauth') return 'AgentSam Browser OAuth';
+  if (k === 'agentsam_cf_browser_oauth') return 'Cloudflare Browser OAuth';
+  return k || String(authType || 'unknown');
+}
+
+function patchBrowserSessionEmail(email, options = {}) {
+  const cleanEmail = email == null ? '' : String(email).trim();
+  if (!cleanEmail) return;
+  try {
+    const session = readAccountSession(options);
+    if (!session?.access_token) return;
+    if (session.email === cleanEmail) return;
+    saveAccountSession({ ...session, email: cleanEmail }, options);
+  } catch {
+    /* best effort — do not fail whoami */
+  }
 }
 
 export async function collectWhoami(options = {}) {
   const env = options.env || process.env;
   const apiKey = resolveAccountApiKey({ env, explicit: options.token || '', home: options.home });
-  const browserSession = describeAccountSession({ env, home: options.home });
+  let browserSession = describeAccountSession({ env, home: options.home });
   const authorityLoader = options.authorityLoader || resolveAccountAuthority;
   const active = await authorityLoader({
     env,
@@ -69,9 +140,19 @@ export async function collectWhoami(options = {}) {
     signal: options.signal,
   });
   const credentials = listProviderCredentialStatus({ env, home: options.home });
+  const localTerminal = options.localTerminal
+    || await collectLocalTerminalContext({ env, home: options.home });
+  const platformIssuer = resolvePlatformAccountIssuer(env);
+  const appContext = resolveCurrentAppContext({
+    root: options.root,
+    cwd: options.cwd || process.cwd(),
+  });
 
+  const activeKind = normalizeAuthKind(active.kind);
+  // Project capabilities after we know tokenPermissions (below) when possible.
+  let capabilities = options.capabilities || null;
   const base = {
-    schema_version: 3,
+    schema_version: 4,
     ok: false,
     command_id: 'whoami',
     risk: 'read',
@@ -82,29 +163,67 @@ export async function collectWhoami(options = {}) {
     authType: null,
     authLabel: null,
     authority: 'inneranimalmedia',
+    namespaces: {
+      platform_issuer: platformIssuer,
+      app_id: appContext.app_id,
+      host_origin: appContext.host_origin,
+      app_context_source: appContext.source,
+      note: 'PLATFORM issuer ≠ APP HOST — do not alias',
+    },
     identity: null,
     account: null,
     credential: null,
     tokenPermissions: [],
-    capabilities: capabilityProbe(credentials),
+    capabilities,
     active_auth: {
       configured: Boolean(active.value || active.error),
-      kind: active.kind || null,
+      kind: activeKind,
       source: active.source || null,
       valid: null,
       error: active.error || null,
     },
     api_key: {
       configured: Boolean(apiKey.value || apiKey.error),
+      kind: 'agentsam_api_key',
       source: apiKey.source || null,
       valid: apiKey.error ? false : null,
       error: apiKey.error || null,
     },
-    browser_session: browserSession,
+    browser_session: {
+      ...browserSession,
+      kind: browserSession.kind || (browserSession.configured ? 'agentsam_browser_oauth' : null),
+    },
+    cf_browser_oauth: {
+      kind: 'agentsam_cf_browser_oauth',
+      configured: false,
+      source: null,
+      next: 'agentsam cloudflare login --pack agentsam',
+    },
     provider_credentials: credentials,
+    // Local ExecOS profiles stay visible even when remote context fails.
+    terminal: safeTerminalContext(localTerminal),
   };
 
-  if (!active.value) return base;
+  if (!active.value) {
+    if (!capabilities) {
+      capabilities = await projectWhoamiCapabilities({
+        env,
+        home: options.home,
+        cwd: options.cwd,
+        discoverRemote: options.discoverRemote !== false,
+        tokenPermissions: [],
+      });
+      base.capabilities = capabilities;
+    }
+    if (/IAM_OAUTH_ISSUER/i.test(String(active.error || ''))) {
+      base.active_auth.next =
+        'source ~/.agentsam/load-agent-env.sh   # loads AGENTSAM_API_KEY + IAM_OAUTH_ISSUER';
+    } else if (!apiKey.value) {
+      base.active_auth.next =
+        'agentsam api-key create --store keychain --activate && eval "$(agentsam env shell --profile default)"';
+    }
+    return base;
+  }
 
   try {
     const loader = options.contextLoader || ((token) => getJson('/api/sdk/context', {
@@ -118,18 +237,36 @@ export async function collectWhoami(options = {}) {
       signal: options.signal,
     }));
     const context = await loader(active.value);
-    const authType = context?.auth_type || (active.kind === 'api_key' ? 'api_key' : 'oauth_session');
+    const authType = String(context?.auth_type || '').trim()
+      || (activeKind === 'agentsam_api_key' ? 'api_key' : 'browser_oauth');
     const tokenPermissions = Array.isArray(context?.tokenPermissions)
       ? context.tokenPermissions
       : Array.isArray(context?.credential?.scopes)
         ? context.credential.scopes
         : [];
-    const authLabel =
-      authType === 'api_key'
-        ? 'AgentSam API Key'
-        : authType === 'oauth_session'
-          ? 'OAuth Session'
-          : String(authType);
+    if (!capabilities) {
+      capabilities = await projectWhoamiCapabilities({
+        env,
+        home: options.home,
+        cwd: options.cwd,
+        discoverRemote: options.discoverRemote !== false,
+        tokenPermissions,
+      });
+    } else if (capabilities.terminal == null) {
+      const { projectTerminalCapability } = await import('../lib/terminal-scopes.js');
+      capabilities = { ...capabilities, terminal: projectTerminalCapability(tokenPermissions) };
+    }
+    const ownerAccountId = context?.owner_account_id || context?.account_id || context?.user_id || null;
+    const email = context?.email || context?.user?.email || active.session?.email || browserSession.email || null;
+
+    if (email) {
+      patchBrowserSessionEmail(email, { env, home: options.home });
+      browserSession = describeAccountSession({ env, home: options.home });
+    }
+
+    const cfConnected = context?.cloudflare?.ok === true
+      || context?.cloudflare?.status === 'connected'
+      || Boolean(context?.cloudflare?.connection);
 
     return {
       ...base,
@@ -138,15 +275,17 @@ export async function collectWhoami(options = {}) {
       loggedIn: true,
       authenticated: true,
       authType,
-      authLabel,
+      authLabel: authLabelFor(activeKind, authType),
       identity: {
-        user_id: context?.user_id || null,
-        account_id: context?.account_id || null,
-        email: context?.email || context?.user?.email || null,
+        user_id: context?.user_id || ownerAccountId || null,
+        account_id: ownerAccountId,
+        owner_account_id: ownerAccountId,
+        email,
       },
       account: {
-        id: context?.account_id || context?.user_id || null,
-        display_name: context?.email || context?.user?.email || context?.account_id || null,
+        id: ownerAccountId,
+        display_name: email || ownerAccountId || null,
+        email,
       },
       credential: context?.credential
         ? {
@@ -159,18 +298,36 @@ export async function collectWhoami(options = {}) {
             expires_at: context.credential.expires_at || null,
             last_used_at: context.credential.last_used_at || null,
           }
-        : active.kind === 'api_key'
+        : activeKind === 'agentsam_api_key'
           ? { id: null, name: null, prefix: null, status: 'active' }
           : null,
       tokenPermissions,
-      capabilities: capabilityProbe(credentials),
-      active_auth: { ...base.active_auth, valid: true, error: null },
-      api_key: active.kind === 'api_key' ? { ...base.api_key, valid: true, error: null } : base.api_key,
-      cloudflare_connected: context?.cloudflare?.ok === true,
+      capabilities,
+      active_auth: { ...base.active_auth, kind: activeKind, valid: true, error: null },
+      api_key: activeKind === 'agentsam_api_key'
+        ? { ...base.api_key, valid: true, error: null }
+        : base.api_key,
+      browser_session: {
+        ...browserSession,
+        kind: 'agentsam_browser_oauth',
+        email: email || browserSession.email || null,
+        user_id: browserSession.user_id || ownerAccountId || null,
+        account_id: browserSession.account_id || ownerAccountId || null,
+      },
+      cf_browser_oauth: {
+        kind: 'agentsam_cf_browser_oauth',
+        configured: cfConnected,
+        source: cfConnected ? 'user_oauth_tokens' : null,
+        next: cfConnected
+          ? 'agentsam cloudflare permissions --json'
+          : 'agentsam cloudflare login --pack agentsam',
+      },
+      provider_credentials: attachOwnerAccountId(credentials, ownerAccountId),
+      cloudflare_connected: cfConnected,
       byok: context?.byok && typeof context.byok === 'object'
         ? Object.fromEntries(Object.entries(context.byok).map(([key, value]) => [key, { configured: value?.configured === true }]))
         : {},
-      terminal: safeTerminalContext(context?.terminal),
+      terminal: safeTerminalContext(mergeTerminalContexts(context?.terminal, localTerminal)),
     };
   } catch (error) {
     const rawMessage = error?.message || String(error);
@@ -179,8 +336,16 @@ export async function collectWhoami(options = {}) {
       : rawMessage;
     return {
       ...base,
-      active_auth: { ...base.active_auth, valid: false, error: message },
-      api_key: active.kind === 'api_key' ? { ...base.api_key, valid: false, error: message } : base.api_key,
+      active_auth: {
+        ...base.active_auth,
+        valid: false,
+        error: message,
+        next: /IAM_OAUTH_ISSUER/i.test(message)
+          ? 'source ~/.agentsam/load-agent-env.sh'
+          : 'agentsam login  # or agentsam whoami --json for detail',
+      },
+      api_key: activeKind === 'agentsam_api_key' ? { ...base.api_key, valid: false, error: message } : base.api_key,
+      terminal: safeTerminalContext(localTerminal),
     };
   }
 }
@@ -208,6 +373,7 @@ export function renderWhoami(status) {
     lines.push(`  API key        ${status.api_key?.configured ? status.api_key?.valid === false ? 'invalid' : 'configured' : 'not configured'}`);
     lines.push(`  browser login  ${status.browser_session?.configured ? 'stored' : 'not configured'}`);
     if (status.active_auth?.error) lines.push(`  error          ${status.active_auth.error}`);
+    if (status.active_auth?.next) lines.push(`  next           ${status.active_auth.next}`);
     lines.push('');
     if (status.browser_session?.configured && status.active_auth?.error) {
       lines.push('  tip            A login session is saved locally, but the server rejected it on this');
@@ -215,16 +381,47 @@ export function renderWhoami(status) {
       lines.push('                 `agentsam whoami --json` for the full response.');
     } else if (!status.api_key?.configured) {
       lines.push('  tip            Run `agentsam login` then `agentsam api-key create --store keychain --activate`.');
+      lines.push('                 Then: source ~/.agentsam/load-agent-env.sh');
+    } else if (status.active_auth?.next) {
+      lines.push(`  tip            ${status.active_auth.next}`);
     }
   }
+
+  const shadow = describeAuthShadow(status);
+  if (shadow) {
+    lines.push('');
+    lines.push(...shadow);
+  }
+
   lines.push('');
   lines.push('  Capabilities');
   const caps = status.capabilities || {};
   for (const [key, value] of Object.entries(caps)) {
+    if (key === 'edit' || key === 'tools' || key === 'cloudflare') continue;
     const available = value?.available === true ? 'yes' : 'no';
-    const extra = value?.configuredProviders != null ? ` · providers ${value.configuredProviders}` : '';
+    let extra = '';
+    if (key === 'terminal' && value?.lanes) {
+      const lanes = Object.entries(value.lanes)
+        .filter(([, on]) => on)
+        .map(([lane]) => lane);
+      extra = lanes.length ? ` · ${lanes.join(', ')}` : ' · (no terminal:* on this key)';
+    } else if (Array.isArray(value?.configuredProviders)) {
+      extra = ` · providers ${value.configuredProviders.join(',') || 0}`;
+    } else if (value?.configuredProviders != null) {
+      extra = ` · providers ${value.configuredProviders}`;
+    } else if (Array.isArray(value?.drivers)) {
+      const ids = value.drivers.map((d) => (typeof d === 'string' ? d : d.id)).filter(Boolean);
+      if (ids.length) extra = ` · ${ids.join(', ')}`;
+    }
     lines.push(`  ${key.padEnd(14)} ${available}${extra}`);
   }
+  if (status.capabilities?.edit) {
+    lines.push('');
+    lines.push('  Edit capabilities');
+    for (const [key, cmd] of Object.entries(status.capabilities.edit)) {
+      lines.push(`  ${key.padEnd(18)} ${cmd}`);
+    }
+  }
   lines.push('');
   lines.push('  Provider credentials');
   for (const row of status.provider_credentials || []) {
@@ -239,6 +436,73 @@ export function renderWhoami(status) {
   return lines.join('\n');
 }
 
+/**
+ * When browser OAuth exists but API key won authority — explain, don't imply login failed.
+ */
+export function describeAuthShadow(status = {}) {
+  const browser = status.browser_session || {};
+  const active = status.active_auth || {};
+  const apiKey = status.api_key || {};
+  if (!browser.configured) return null;
+  if (active.kind === 'agentsam_browser_oauth' || active.kind === 'browser_oauth') return null;
+  if (!(active.kind === 'agentsam_api_key' || active.kind === 'api_key' || apiKey.configured)) return null;
+
+  const lines = [
+    '  Authority lanes',
+    `  Current authoritative credential`,
+    `    agentsam_api_key · ${apiKey.source || active.source || 'environment'}`,
+    '',
+    '  agentsam_browser_oauth',
+    `    available${browser.expired ? ' · expired' : ''}${browser.refreshable ? ' · refreshable' : ''} but not currently authoritative`,
+    browser.email ? `    email ${browser.email}` : '    email (resolve via agentsam whoami after login)',
+    '',
+    '  Why?',
+    '    AGENTSAM_API_KEY (or an explicit aak_* token) has higher precedence than browser OAuth.',
+    '',
+    '  Options',
+    '    keep API key   (default — no action)',
+    '    prefer session unset AGENTSAM_API_KEY && agentsam whoami',
+    '    details        agentsam whoami --json',
+  ];
+  return lines;
+}
+
+/**
+ * Post-login human summary — never claim OAuth is authoritative when API key still wins.
+ */
+export function renderLoginResult(status = {}) {
+  const lines = ['', '  ✓ Browser OAuth login saved', ''];
+  const shadow = describeAuthShadow(status);
+  if (shadow) {
+    lines.push('  Current authoritative credential');
+    lines.push(`    agentsam_api_key · ${status.api_key?.source || status.active_auth?.source || 'environment'}`);
+    lines.push('');
+    lines.push('  agentsam_browser_oauth');
+    lines.push('    available but not currently authoritative');
+    lines.push('');
+    lines.push('  Why?');
+    lines.push('    AGENTSAM_API_KEY has higher precedence.');
+    lines.push('');
+    lines.push('  [enter] keep API key');
+    lines.push('  [s]     use OAuth session  →  unset AGENTSAM_API_KEY && agentsam whoami');
+    lines.push('  [d]     details            →  agentsam whoami --json');
+    lines.push('');
+  } else if (status.active_auth?.kind === 'agentsam_browser_oauth' || status.active_auth?.kind === 'browser_oauth') {
+    lines.push('  Current authoritative credential');
+    lines.push('    agentsam_browser_oauth');
+    lines.push('');
+    lines.push('  Next');
+    lines.push('    agentsam api-key create --store keychain --activate');
+    lines.push('    agentsam whoami');
+    lines.push('');
+  } else {
+    lines.push('  Current authoritative credential');
+    lines.push(`    ${status.authLabel || status.active_auth?.kind || 'unknown'} · ${status.active_auth?.source || 'runtime'}`);
+    lines.push('');
+  }
+  return lines.join('\n');
+}
+
 export async function runWhoami(argv = [], options = {}) {
   const allowed = new Set(['--json']);
   const unknown = argv.filter((arg) => !allowed.has(arg));

package/src/features/resolve.js

@@ -38,6 +38,8 @@ export function normalizeProviderTemplateId(id) {
   const key = String(id || '').trim().toLowerCase();
   if (!key) return '';
   if (key === 'iam') return 'inneranimalmedia';
+  if (key === 'google-desktop') return 'google_desktop';
+  if (key === 'openai' || key === 'chatgpt-hosted' || key === 'chatgpt_hosted') return 'chatgpt';
   return key;
 }
 

package/src/index.js

@@ -242,6 +242,10 @@ export {
   pingMcpServer,
   listMcpTools,
   callMcpTool,
+  withMcpClient,
+  listCloudflareMcpBundles,
+  getCloudflareMcpBundle,
+  scopesForCloudflareMcpBundle,
   recordToolReceipt,
   getSessionToolReceipts,
   clearSessionToolReceipts,